diff --git a/rules/windows/process_creation/proc_creation_win_susp_runonce_execution.yml b/rules/windows/process_creation/proc_creation_win_susp_runonce_execution.yml
index da7c289fe..8db6cb610 100644
--- a/rules/windows/process_creation/proc_creation_win_susp_runonce_execution.yml
+++ b/rules/windows/process_creation/proc_creation_win_susp_runonce_execution.yml
@@ -24,8 +24,7 @@ detection:
             - '/AlternateShellStartup'
             - '/r'
     filter:
-        CommandLine|contains:
-           - '/Run6432'
+        CommandLine|contains: '/Run6432'
     condition: all of selection* and not filter
 falsepositives:
     - Unknown